Description
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
Published: 2026-10-20
Score: 4.3 Medium
EPSS: n/a
KEV: No
Impact: Confidentiality Disclosure
Action: Apply Patch
AI Analysis

Impact

A vulnerability in Oracle Agile Product Lifecycle Management for Process version 6.2.4 allows a low‑privileged attacker who can reach the system over HTTP to read a subset of accessible data. The bug requires no user interaction and does not affect integrity or availability but exposes confidential information that could be valuable to a malicious actor. The weakness is an information‑exposure flaw that permits unauthorized data disclosure.

Affected Systems

Oracle Corporation’s Agile Product Lifecycle Management for Process, specifically version 6.2.4 of the Product Quality Management component.

Risk and Exploitability

The CVSS v3.1 base score of 4.3 indicates a low‑to‑moderate severity with confidentiality impact only. No EPSS value is available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is network‑based over HTTP, requiring the attacker to have low privileges on the system. While the likelihood of exploitation is uncertain, the consequence is limited to sensitive data disclosure rather than system compromise or denial of service.

Generated by OpenCVE AI on October 21, 2026 at 00:55 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor‑supplied patch or upgrade Oracle Agile Product Lifecycle Management to a version that contains the fix for version 6.2.4.
  • Restrict HTTP access to the application by implementing firewall rules or reverse‑proxy authentication, limiting connections to trusted IP ranges.
  • Enforce strict role‑based access controls and remove or disable unnecessary user accounts to reduce the available low‑privilege surface.

Generated by OpenCVE AI on October 21, 2026 at 00:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 01:15:00 +0000

Type Values Removed Values Added
Title Low-Privilege HTTP Data Disclosure in Oracle Agile Product Lifecycle Management 6.2.4
Weaknesses CWE-200
CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Agile Product Lifecycle Management for Process accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
First Time appeared Oracle
Oracle agile Product Lifecycle Management For Process
CPEs cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.4:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle agile Product Lifecycle Management For Process
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

Subscriptions

Oracle Agile Product Lifecycle Management For Process
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-20T21:21:45.208Z

Reserved: 2026-09-28T15:40:09.493Z

Link: CVE-2026-101591

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T22:18:12.600

Modified: 2026-10-20T22:18:12.600

Link: CVE-2026-101591

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T01:00:17Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-284

    Improper Access Control